feat(sandbox): add privacy-conscious execution audit records and distinct failure states (closes #21)

[ghzhost]

Summary

Implements privacy-conscious sandbox execution audit records according to the requirements and acceptance criteria in #21.

Key Changes

• Context & Identification: Extended and with optional , attaching a unique , , execution duration (in ), runtime configuration, exit codes, and normalized results to audit logs.
• Privacy First: Submitted code/script and file contents remain excluded from audit log events by default.
• Distinct Failure States: Explicitly handles and audits standard execution, non-zero returncodes (), timeouts (), Docker process/daemon execution errors (), and boundary validation errors ().
• Resilience & Cleanup: Best-effort audit writing ensures logging errors do not interrupt puzzle execution, and temporary execution working directories are reliably cleaned up in across all success/error paths.
• Automated Tests: Added comprehensive test cases in validating field schema, privacy protection, distinct failure states, cleanup guarantees, and runtime resilience. All 29 tests pass.

Closes #21
/claim #21